Description
In the Linux kernel, the following vulnerability has been resolved:

mmc: dw_mmc-rockchip: Add missing private data for very old controllers

The really old controllers (rk2928, rk3066, rk3188) do not support UHS
speeds at all, and thus never handled phase data.

For that reason it never had a parse_dt callback and no driver private
data at all.

Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating
support") makes the private data sort of mandatory, because the init
function checks whether phases are configured internally or through the
clock controller.

This results in the old SoCs then experiencing NULL-pointer dereferences
when they try to access that private-data struct.

While we could have if (priv) conditionals in all places, it's way less
cluttery to just give the old types their private-data struct.
Published: 2026-06-25
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing driver private structure in the dw_mmc-rockchip module causes a NULL‑pointer dereference when old SoCs (rk2928, rk3066, rk3188) attempt to use phase data that they never support. This dereference results in a kernel crash (oops) and can allow an attacker to cause a denial of service by triggering the faulty path. The vulnerability is a classic NULL pointer dereference, defined as CWE‑476.

Affected Systems

The flaw affects Linux kernel builds that include the dw_mmc-rockchip driver and target the very early Rockchip SoCs rk2928, rk3066, and rk3188. Any system that uses those SoCs with an unpatched kernel version will be vulnerable; newer kernel releases that added the private data structure apply the fix.

Risk and Exploitability

The EPSS score of < 1% and the fact that the vulnerability is not listed in CISA KEV suggest no currently known exploitation. The CVSS score of 5.5 indicates moderate severity. A NULL dereference in kernel space can crash the target machine, providing a local denial of service. Based on the description, it is inferred that the attack vector is local and requires the driver to be initialized at boot or by accessing the mmc subsystem. The low EPSS score indicates a modest risk, but the impact is high if an authorized user can trigger the fault.

Generated by OpenCVE AI on August 13, 2026 at 18:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a release that includes commit ff6f0286c896, which adds the missing private data structure for dw_mmc-rockchip.
  • If a kernel upgrade is not yet possible, manually apply the patch or merge the commit into the local source to provide the private data for rk2928, rk3066, and rk3188.
  • As a temporary mitigation, blacklist or disable the dw_mmc-rockchip module on affected systems so that it does not load during boot.
  • Use a firmware configuration that avoids initializing the mmc subsystem on these SoCs until the patch is applied.

Generated by OpenCVE AI on August 13, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 26 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 25 Jun 2026 11:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data. For that reason it never had a parse_dt callback and no driver private data at all. Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") makes the private data sort of mandatory, because the init function checks whether phases are configured internally or through the clock controller. This results in the old SoCs then experiencing NULL-pointer dereferences when they try to access that private-data struct. While we could have if (priv) conditionals in all places, it's way less cluttery to just give the old types their private-data struct.
Title mmc: dw_mmc-rockchip: Add missing private data for very old controllers
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:38:36.850Z

Reserved: 2026-06-09T07:44:35.388Z

Link: CVE-2026-53152

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-06-25T09:16:32.573

Modified: 2026-07-06T17:39:19.837

Link: CVE-2026-53152

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53152 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T18:45:04Z

Weaknesses